Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12-02-2024 19:25
General
-
Target
2024-02-12_9bd223db2855b3132105851b1eab8c6c_goldeneye.exe
-
Size
180KB
-
MD5
9bd223db2855b3132105851b1eab8c6c
-
SHA1
bc9fba551d039a6c5b5b61aee62c34ee35c7fdb4
-
SHA256
bf29b2f520b9fdbe5614450d4fb05da7fd54b8f0edccd8d80dc3d5f1bc787eef
-
SHA512
54e6b019c2e0c08ab5f130bf95dc8fe9c1d4a9298d664fa1296575331a2fa9a34e381599de6c548840da9a99215bf45e8b786dd4ac419cbc3d726c134a3436cd
-
SSDEEP
3072:jEGh0o0lfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG6l5eKcAEc
Malware Config
Signatures
-
Auto-generated rule 12 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_9bd223db2855b3132105851b1eab8c6c_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_9bd223db2855b3132105851b1eab8c6c_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B2F5320-CCB8-4d66-9045-D193437EE801}.exeC:\Windows\{6B2F5320-CCB8-4d66-9045-D193437EE801}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F366BAA-43FF-437a-B060-89970EFB5E83}.exeC:\Windows\{0F366BAA-43FF-437a-B060-89970EFB5E83}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F366~1.EXE > nul4⤵
-
C:\Windows\{E6744C89-B4BD-4671-ADC9-457D07926505}.exeC:\Windows\{E6744C89-B4BD-4671-ADC9-457D07926505}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD54F71D-C34E-474d-A5A3-67BAAF133995}.exeC:\Windows\{FD54F71D-C34E-474d-A5A3-67BAAF133995}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD54F~1.EXE > nul6⤵
-
C:\Windows\{F3D00463-E761-445e-B634-EF0A8D196956}.exeC:\Windows\{F3D00463-E761-445e-B634-EF0A8D196956}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8D901B43-079A-44c6-9A08-7ADF3FA7930B}.exeC:\Windows\{8D901B43-079A-44c6-9A08-7ADF3FA7930B}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C84D8E8-CC23-4225-9CCB-A2758C888FD1}.exeC:\Windows\{8C84D8E8-CC23-4225-9CCB-A2758C888FD1}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{311B2D8B-E6F1-40e6-9C16-DED3BC704DCB}.exeC:\Windows\{311B2D8B-E6F1-40e6-9C16-DED3BC704DCB}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C29E052-6EF2-4f16-9CDE-287139DC09F0}.exeC:\Windows\{3C29E052-6EF2-4f16-9CDE-287139DC09F0}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74703B27-A60C-4ac7-934A-8DAA0E264044}.exeC:\Windows\{74703B27-A60C-4ac7-934A-8DAA0E264044}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4DCE417D-FE79-4dae-951E-A8D86157A207}.exeC:\Windows\{4DCE417D-FE79-4dae-951E-A8D86157A207}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{B844D810-EDF9-4d76-B85C-D0E752D186D5}.exeC:\Windows\{B844D810-EDF9-4d76-B85C-D0E752D186D5}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4DCE4~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74703~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C29E~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{311B2~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C84D~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8D901~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3D00~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E6744~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B2F5~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD5edd18e01aec626a4bcd43622fc42e9e5
SHA10c5ecb9eba92c787c3e6c62f40a32710d39fd3ec
SHA2568e6b0abb7b5a8ba4663869b25b8a35df556c83c78d08f9bdefc1e5743b892b18
SHA5121ef9beaf1e4d9a9adf2bb25615358cc432ea77fa8035bf479bb27db9e9089ed153e311ed4875c19ef021dbfc08fb2df39826bd4f1553bc0d82065ddfedf652e1
-
Filesize
180KB
MD50b0d885ad2394b311ce333e2ca0efea6
SHA1a11e217b23b2528532dbc08f69fb0b89bb2f51cf
SHA256015ac98924564dbd03e5c02bc9004c9edb5849860eb37851dc603b74ae10cfc3
SHA51236c876d8189cfdb1ff3f67be4ea50d880e8bf9219273db1a0685c26e532f516317c8b01aeab0db8db3e14e8b2c82a6f4dd5e1cb2511d30930c9e31ff264c0a6d
-
Filesize
180KB
MD596221d700829404d5ea857438204510d
SHA18257203f7fb8a68330a29763a50438999569ff4d
SHA256eb23d55cb87a50eeb90c00dcf2f5e7a386acc34b01cb773bd2ff928e20aad6ec
SHA512374dd6f1f705a8a04e038d6d49feb2ba5b443b132b86b03cde64f38387b719951a87d65d0b4c0740a3104995bd700e8b3989cb6d601bc6fbce17e5b9d00aa4e0
-
Filesize
180KB
MD5aad52656679de078e4a13236aad3762d
SHA1dd82ccacdc37ab4e4953755b7c910761933c820b
SHA25662a7cbf44125f36a920bb06374c126ab11b2f7542eb088315deb13b2a9b53d7b
SHA512e609824836bd421c83687ff4fe48b9b5be12cda06cc915f09da8859adbdc97c682a8ee5b2088f810fd4be7eefadc8e4e9f790a211ee32cba443a03db92ee3697
-
Filesize
180KB
MD57790884384401983007c6553ee56c975
SHA1fa909f54ae6480065a99f405748a984b37ea9154
SHA2566a3bc57869889eecb13afa0b4d11563f170a4cacb920dbbbfb53631c4d8896f3
SHA51265906f79c9d130c7808e1974ef713424ecd56d9fbb2ee5bfb94b7e9f02fd478d680353ef3497c7bf12865dff1f4c1199b194d97c6aaa797bdd29d578f8e31d27
-
Filesize
180KB
MD5fa04865878625298722096376e3e3bed
SHA12b786018d946db124c096bc69a0a0854f9f66718
SHA25622feeba5b2c6b4ea5478f17e53cff0784bc3a262f8cec11310f2f4576329278f
SHA512fece8b8efc2c2ced2eb5ee55abba2166ed22951cbe6bf4d34442f17adbb4115b945806ba152e0fcd6ffab643f5fc311e3a335d3d09df37d0da1828cef7a68614
-
Filesize
180KB
MD58ff1e78bf585fa11776eda83095439ae
SHA1fea0515e61bf183ec2edf0a507aee89baf0a6419
SHA25684a2ad7a9f368c858f7951fe396fa1a3357ed9e2ad8f7e587ad9a5d25f4f55cb
SHA5129ce58f51297e9e866f0ed5cbe2c9bcf208ebe68e559be9f8c1355e107f8ef63f356ec129f8d2e2e0cf6dd3ecc21309ae2c2d6f4c8aed92af2abf1f04bf571278
-
Filesize
180KB
MD5f7c86f6fce2cc2d56a3f6785e25d1218
SHA178ec42ad4ca2cf5f1b75f3aac99bdbf2a11d5e23
SHA256896751be582292b2891f90d69238f9d7e34013d3b66ae8cbb895d4a35242917e
SHA512a39a35bd22259f4f74e31aefdffb02865c3bc8cf64e09704d90af671f8cc290ff11c375e091f6f7d1e5ab97c997b68d50ad244b60df0a8d23bdfe0372c0e5e26
-
Filesize
180KB
MD5f142ad06ebf3249fc91b5494b48ac8ed
SHA188bb9fba77653e6ed96f97d9af17ff4dc8ba38ec
SHA256cfd81da191d3a50b07e86d293f40764e5538e0928471fe73d3bc6e7347eebd49
SHA512671d346d58f23657d4c200ad36979a3cb78e5b7c6dceed5b26c4a34de4ea85cbab95abbd3bacc76347664c3c7c97bb52e1d340e4be6bf68a3d34d54f3cb97924
-
Filesize
180KB
MD5143ab2f1848d38bc9d21c43e3d8d1a24
SHA168abdfb77633faf860c9c3312ec747c254073a00
SHA256b5892ae5af27c3f3b8f254d4d8e00d91daac8a08758e1a58e9d242cc5db8e9c1
SHA5129bb7606508e0ec95a848cc526f519d0bd144959fb559656dcf0a390e6e27647a16f68af51ceddef8e547460025ce5954e1d077bbd1d634b2937799ddc335bb94
-
Filesize
180KB
MD54265151adc22fcfa6e36bfbef5947d8b
SHA13e06e707a72ef2d73496f51e0fa927f2ada8176d
SHA256a7a53a02eb630765312f044085fc3ba546dc908625e436bd551a9b005f829edc
SHA512017373575245fcc7704b859bc7b406deb675f0762ea853bdc346b794fdcf4a3b83eaf34c21f90b0aaf55886ee7b320fb8cd0c03226bb029b0b3c3496359b8b88
-
Filesize
180KB
MD583039b9105ea03b5852f5cd09488e964
SHA1ac3102618f29c6563b12cf6886b4763cc32858b1
SHA2567b7750dfb3155fc9b657b30cdae793558303b320c4761b8948e55a8926b2ab7e
SHA51298a4f09e633844dd7bc3d46b06812ce336bc2a59f1a820d3ef2ab3f8d618ff727336e262a505d3060d69561e05b1dc9632f124d53387f79cea2e5f392a5ece97